tylerg/auth-yes
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
auth-yes/tasks/new/2026-0821.01.jul.feat.auth-yes.seamless-3rd-party-sso-1609.md

2.2 KiB
Raw Blame History

TASK METADATA

  • Target Files: auth-yes/server/db.ts, auth-yes/server/oidc.ts, auth-yes/server/main.ts, auth-yes/ui/admin/integrations.tsx (and related UI files)
  • Core Objective: Implement seamless 3rd-party SSO via a Zero-Click OIDC Provider and Traefik ForwardAuth Header injection.
  • Dependencies: Core Auth-Yes session mechanisms, Valkey cache, Hono routing, React/JSX for UI.
  • Additional Important Notes: Ensure OIDC logic is decoupled from main.ts to prevent a monolith. Database migrations are required for OIDC clients/authorization codes.

Phase 2: The Bonus Stage — Seamless 3rd-Party SSO (Gitea, Portainer, etc.)

Your vision for frictionless 3rd-party access without double-logins is achievable through two native patterns we can bring directly into auth-yes:

1. The "Zero-Click" OIDC Provider in auth-yes

• Most self-hosted power tools (Gitea, Nextcloud, Grafana, Portainer, Proxmox, Vaultwarden) support standard OpenID Connect (OIDC). • When auth-yes exposes standard OIDC endpoints (/oauth/authorize, /oauth/token, /oauth/userinfo): • You click "Login with Auth-Yes" on Gitea (or configure Gitea for auto-login). • Gitea redirects to auth.atyg.org. • Because you already have your .atyg.org passkey cookie active, auth-yes instantly authorizes and redirects back in ~10 milliseconds without presenting any login dialogs. • Gitea automatically creates and syncs your account on the fly.

2. Reverse-Proxy Header Authentication (Traefik ForwardAuth)

• Apps like Gitea have native Reverse Proxy Auth (ENABLE_REVERSE_PROXY_AUTHENTICATION = true). • When Traefik calls /api/forward-auth, auth-yes injects X-Forwarded-User: . Gitea immediately trusts the header and logs you in transparently with zero interaction.

3. 3rd-Party App Integrations Manager in Admin Console

• We can expand our Application Registry (/admin/apps) with an Integrations Catalog (Client IDs, OIDC secrets, callback URLs, and role-mapping presets for Gitea, Grafana, Portainer, etc.). • This gives you a single pane of glass to manage passkey-secured SSO across your entire self-hosted ecosystem, allowing you to optionally bypass Cloudflare Zero Trust popups entirely.